A portion of the disclosure of this patent document contains material which is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent files or records, but otherwise reserves all copyright rights whatsoever.
The present invention is related to telecommunications, and in particular, to a telecommunications system and method for generating a normal behavior profile of a customer and for determining a deviation from the generated profile to detect fraudulent activity.
It is well known that the telecommunications industry regularly suffers major losses due to fraud. The various types of fraud may be classified into two categories: subscription fraud and superimposed fraud. In subscription fraud, an account is obtained without any intention to pay the bill. In such cases, abnormal usage occurs throughout the active period of the account. The account is usually used for call selling or intensive self-usage, for example. The superimposed fraud is carried out when fraudsters xe2x80x9ctake overxe2x80x9d a legitimate account. The abnormal usage is superimposed upon the normal usage of a legitimate customer. Examples of such cases include cellular cloning, calling card theft, and cellular handset theft, to name a few.
To combat telecommunications fraud, various conventional techniques attempt to discover so-called xe2x80x9cprobably fraudulentxe2x80x9d patterns based on historical data and then to detect the xe2x80x9cprobably fraudulentxe2x80x9d patterns. The fraud detection system collects data representing the prior transactions by the calling party, by the user of credit or debit cards, etc. The collected data is then searched for the xe2x80x9cprobably fraudulentxe2x80x9d patterns in user behavior. For example, if the person""s international telephone calls continue for over 2 hours in a 24-hour time period, such activity would most likely constitute a fraudulent pattern.
This conventional approach to fraud detection, however, is limited in several ways and has a number of disadvantages. First, fraud patterns are customer-dependent. Since each customer demonstrates an individual behavior, certain usage patterns may be suspicious for one customer, but are normal for another. Second, in order to construct a comprehensive fraud classification system, examples of all fraud patterns must be taken into account. The large number of possible fraud patterns and the constant emergence of new ones make it impractical to create such a fraud classification system. Further, it is difficult to obtain training data that is properly classified as fraudulent and non-fraudulent.
A need therefore exists to overcome the disadvantages of the above-noted fraud detection approaches, as well as other conventional approaches to fraud detection in the telecommunications industry.
It is an object of the present invention to generate a normal (ordinary) behavior profile of a customer.
It is another object of the present invention to detect a deviation from the generated normal behavior profile.
It is yet another object of the present invention to identify any unusual activity on behalf of the customer.
These and other objects, features and advantages are accomplished by a computer implemented method and apparatus for determining a normal customer behavior profile that includes a plurality of transactions pertaining to an activity. The normal behavior profile is used to alert of an unusual activity. According to the present invention, a number of prototypical transactions is selected from a plurality of transactions. The extracted prototypical transactions collected during a first predetermined time interval are arranged into a first behavior profile. A plurality of first behavior profiles is obtained during a second predetermined time interval that is comprised of a plurality of first predetermined time intervals. The first behavior profiles obtained during the second predetermined time interval are arranged into a number of clusters. A prototypical first behavior profile is determined for each cluster, and the determined prototypical first behavior profiles are arranged into a plurality of records for representing a second behavior profile.
In accordance with one aspect of the present invention, each prototypical first behavior profile is located at a respective center of each cluster.
In accordance with another aspect of the present invention, each transaction is defined by at least one attribute which is represented either non-numerically or numerically.